feat: v1.1.0 账号化重构 + 三级 Webhook + 设置中心 + Vite 工具链

- 账号化:节点更名账号,/nodes -> /accounts;添加账号直达 Cloudflare OAuth,自动创建账号并同步账号下全部域名(catch-all 邮箱随同步创建)
- 域名:移除手工添加;点击域名『设置 Email Workers』= 部署账号级 Email Worker + Email Routing + catch-all;支持按账号筛选
- Webhook 三级模型:邮箱 -> 域名 -> 全局,收信取第一个命中者;支持自定义请求头与 key(默认 Authorization: Bearer <key>,兼做 X-WmailHub-Signature 签名);独立 webhooks 实体与 /webhooks、/keys 页面删除,Key 管理收进设置模态窗口
- 设置中心:全局 Webhook / 默认 Node Ingress 地址 / 修改密码 / API & MCP Keys(生成、撤销、删除)
- UI:Header 标题副标题紧凑化(修复溢出),LOGO 加版本号 tag(v1.1.0 取自 package.json),各列表页搜索框
- 工具链:前端构建 Bun.build -> Vite(vite 8 + @vitejs/plugin-react)
- 后端:/api/settings、POST /api/domains/:id/setup、0002 迁移(投递行固化三级目标配置);MCP 去 list_webhooks(5 工具);迁移执行器加 _migrations 记录
- 测试:44/44(新增 settings 套件、webhook 三级优先级/SSRF/签名);UI 冒烟 11/11

console/src/routes/oauth.ts

@@ -12,10 +12,10 @@
 import { Hono } from "hono";
 import type { Env, AppVars } from "../env.ts";
 import { requireSession } from "../middleware.ts";
-import { aesEncrypt, deriveAesKey, ids } from "../../../shared/src/index.ts";
+import { ids } from "../../../shared/src/index.ts";
 import { CF_OAUTH_AUTHORIZE_URL, CF_OAUTH_SCOPES, getCFApi } from "../services/cfapi.ts";
-import { provisionNode } from "../services/provision.ts";
-import { getSetting } from "../db.ts";
+import { provisionNode, createNode } from "../services/provision.ts";
+import { getSetting, encryptConnectionToken } from "../db.ts";
 import { nowIso, readJson } from "../util.ts";
 
 type App = Hono<{ Bindings: Env; Variables: AppVars }>;
@@ -23,6 +23,9 @@ type App = Hono<{ Bindings: Env; Variables: AppVars }>;
 /** # 成员变量: OAuth state 有效期(秒) **/
 const STATE_TTL_SECONDS = 300;
 
+/** # 成员变量: 自动创建账号时的默认 Node Ingress 地址(可在设置中修改) **/
+export const DEFAULT_INGRESS_URL = "http://127.0.0.1:18788/ingress/email";
+
 /** # 函数
  * 是否使用真实 Cloudflare OAuth
  */
@@ -45,13 +48,24 @@ export function oauthRoutes(): App {
     });
   });
 
-  /** 开始授权:创建 state 并返回跳转 URL */
+  /** 开始授权:node_id 缺省时自动创建账号;创建 state 并返回跳转 URL */
   app.get("/cloudflare/start", async (c) => {
-    const nodeId = new URL(c.req.url).searchParams.get("node_id") ?? "";
-    const node = await c.env.DB.prepare("SELECT id FROM nodes WHERE id = ? AND status = 'pending_oauth' OR id = ?")
-      .bind(nodeId, nodeId)
-      .first<{ id: string }>();
-    if (!node) return c.json({ error: "node not found" }, 404);
+    let nodeId = new URL(c.req.url).searchParams.get("node_id") ?? "";
+    if (nodeId) {
+      const node = await c.env.DB.prepare("SELECT id FROM nodes WHERE id = ? AND status != 'revoked'")
+        .bind(nodeId)
+        .first<{ id: string }>();
+      if (!node) return c.json({ error: "account not found" }, 404);
+    } else {
+      // 添加账号:直接进入 OAuth,授权成功后自动落地账号(identity + 域名同步)
+      const ingressUrl =
+        (await getSetting(c.env, "default_ingress_url"))?.trim() || DEFAULT_INGRESS_URL;
+      const created = await createNode(c.env, {
+        name: `Cloudflare 账号 ${new Date().toISOString().slice(0, 10)}`,
+        ingressUrl,
+      });
+      nodeId = created.nodeId;
+    }
 
     const state = "cfstate_" + ids.oauthState();
     await c.env.DB.prepare(
@@ -92,7 +106,7 @@ export function oauthRoutes(): App {
       // 加密入库(不进前端/日志)
       await saveConnection(c.env, token.accessToken, token.expiresIn);
       const result = await provisionNode(c.env, { nodeId: verdict.nodeId, accessToken: token.accessToken });
-      const target = `/nodes?provision=${encodeURIComponent(verdict.nodeId)}&ok=${result.ok ? 1 : 0}`;
+      const target = `/accounts?provision=${encodeURIComponent(verdict.nodeId)}&ok=${result.ok ? 1 : 0}`;
       return c.redirect(target, 302);
     } catch (err) {
       return c.text(`OAuth provisioning failed: ${err instanceof Error ? err.message : String(err)}`, 500);
@@ -143,8 +157,7 @@ async function consumeState(
  * OAuth access token 加密入库
  */
 async function saveConnection(env: Env, accessToken: string, expiresIn: number): Promise<void> {
-  const key = await deriveAesKey(await getSetting(env, "app_secret") ?? "wmailhub");
-  const encrypted = await aesEncrypt(key, accessToken);
+  const encrypted = await encryptConnectionToken(env, accessToken);
   await env.DB.prepare(
     `INSERT INTO oauth_connections (id, provider, account_id, encrypted_access_token, refresh_token, expires_at, created_at, updated_at)
      VALUES (?, 'cloudflare', NULL, ?, NULL, ?, ?, ?)`,